quarkusio/quarkus · error · SpiffeConnectionException

X.509-SVID response from SPIRE agent has empty certificate c

Error message

X.509-SVID response from SPIRE agent has empty certificate chain

What it means

The first X.509-SVID in the SPIRE agent response carried an empty x509_svid (certificate chain) field. The Workload API contract requires each SVID to include its DER-encoded certificate chain; the client treats the response as malformed rather than proceeding without certificates.

Source

Thrown at extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java:293

        record WorkloadJsonWebTokenImpl(String token, String subject, Set<String> audience,
                Instant expiry) implements WorkloadJsonWebToken {
        }
        return new WorkloadJsonWebTokenImpl(token, sub, Set.copyOf(audience), expiry);
    }

    private static WorkloadCertificateDocument toWorkloadCertificate(X509SVIDResponse response)
            throws SpiffeConnectionException {
        List<X509SVID> svids = response.getSvidsList();
        if (svids.isEmpty()) {
            throw new SpiffeConnectionException("X.509-SVID response from SPIRE agent contains no SVIDs");
        }
        X509SVID svid = svids.get(0);

        String protoSpiffeId = svid.getSpiffeId();
        SpiffeValidator.validateSpiffeId(protoSpiffeId);
        if (svid.getX509Svid().isEmpty()) {
            throw new SpiffeConnectionException("X.509-SVID response from SPIRE agent has empty certificate chain");
        }
        if (svid.getX509SvidKey().isEmpty()) {
            throw new SpiffeConnectionException("X.509-SVID response from SPIRE agent has empty private key");
        }
        if (svid.getBundle().isEmpty()) {
            throw new SpiffeConnectionException("X.509-SVID response from SPIRE agent has empty trust bundle");
        }

        List<X509Certificate> certChain = parseCertificates(svid.getX509Svid().toByteArray(), "certificate chain");
        if (certChain.isEmpty()) {
            throw new SpiffeConnectionException("X.509-SVID certificate chain is empty");
        }

        X509Certificate leaf = certChain.get(0);
        String sanSpiffeId = SpiffeValidator.validateLeaf(leaf);
        if (!protoSpiffeId.equals(sanSpiffeId)) {
            throw new SpiffeConnectionException(
                    "X.509-SVID proto SPIFFE ID does not match the leaf certificate URI SAN; proto: "

View on GitHub (pinned to e1c734241f)

Solutions

1. Upgrade/downgrade the SPIRE agent to a version compatible with the SPIRE server (spire-agent version vs spire-server version).
2. Ensure the client talks directly to the real Workload API socket, not a proxy that truncates messages.
3. Re-fetch the certificate; if persistent, restart the SPIRE agent so it re-attests and repopulates SVIDs.
4. Check agent logs for Workload API errors when serving this workload UID.

try {
    doc = client.getWorkloadCertificate();
} catch (SpiffeConnectionException e) {
    if (e.getMessage().contains("empty certificate chain")) {
        doc = retryWithBackoff(client::getWorkloadCertificate);
    } else throw e;
}

When it happens

Trigger: getWorkloadCertificate when the selected X509SVID's getX509Svid() ByteString is empty, even though the svids list itself is non-empty.

Common situations: A malformed or incompatible SPIRE agent version responding incorrectly; a proxy/interceptor zeroing fields; protobuf decoding issue from a mismatched Workload API version.

Understand the failure class

• SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

• X.509-SVID response from SPIRE agent contains no SVIDs
• X.509-SVID response from SPIRE agent has empty private key
• JWT-SVID from SPIRE agent has no token
• JWT-SVID from SPIRE agent is already expired
• X.509-SVID response from SPIRE agent has empty trust bundle

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/2a5a54264bc12ca4. Report an issue: GitHub.